CVE-2022-39842

2022-09-0500:00:00

ubuntu.com

6.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

3.2 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

17.6%

JSON

DISPUTED An issue was discovered in the Linux kernel before 5.19. In
pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter
has a type conflict of size_t versus int, causing an integer overflow and
bypassing the size check. After that, because it is used as the third
argument to copy_from_user(), a heap overflow may occur. NOTE: the original
discoverer disputes that the overflow can actually happen.

Notes

Author	Note
cascardo	Since Linux limits read/write calls to MAX_RW_COUNT, this cannot be exploited.
rodrigo-zaiden	USN-5975-1 first publication included esm/xenial linux-gcp version 4.15.0-1146.162~16.04.1 by mistake, please refer to USN-6007-1.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-204.215UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-136.153UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-57.63UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1150.163UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1093.101UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1027.31UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1027.31~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1093.102~18.04.2UNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1100.106UNKNOWN
ubuntu22.04noarchlinux-azure< 5.15.0-1030.37UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-204.215	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-136.153	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-57.63	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1150.163	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1093.101	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1027.31	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1027.31~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1093.102~18.04.2	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< 5.4.0-1100.106	UNKNOWN
ubuntu	22.04	noarch	linux-azure	< 5.15.0-1030.37	UNKNOWN